CVE-2025-59345: Dragonfly did not enable authentication for some Manager’s endpoints
Impact The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create preheat jobs.
An unauthenticated adversary with network access to a Manager web UI uses /api/v1/jobs endpoint to create hundreds of useless jobs. The Manager is in a denial-of-service state, and stops accepting requests from valid administrators.
Patches
- Dragonfy v2.1.0 and above.
Workarounds
There are no effective workarounds, beyond upgrading.
References
A third party security audit was performed by Trail of Bits, you can see the full report.
If you have any questions or comments about this advisory, please email us at dragonfly-maintainers@googlegroups.com.
Other sources
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create preheat jobs. An unauthenticated adversary with network access to a Manager web UI uses /api/v1/jobs endpoint to create hundreds of useless jobs. The Manager is in a denial-of-service state, and stops accepting requests from valid administrators. This vulnerability is fixed in 2.1.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59345?
CVE-2025-59345 is a critical vulnerability due to the lack of authentication for the /api/v1/jobs and /preheats endpoints in the Dragonfly Manager web UI.
How do I fix CVE-2025-59345?
To fix CVE-2025-59345, upgrade to Dragonfly version 2.1.0 or later where the vulnerability has been addressed.
What are the potential impacts of CVE-2025-59345?
The impact of CVE-2025-59345 allows unauthenticated users with network access to create, delete, and modify jobs within the Dragonfly Manager.
Who is affected by CVE-2025-59345?
CVE-2025-59345 affects all users of Dragonfly versions prior to 2.1.0.
What endpoints are vulnerable in CVE-2025-59345?
The vulnerable endpoints in CVE-2025-59345 are /api/v1/jobs and /preheats in the Dragonfly Manager web UI.